<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title>kali工具箱</title>
<script src="./static/bootstrap.min.js"></script>
<link rel="stylesheet" href="./static/main.css">
<link rel="stylesheet" href="./static/bootstrap.min.css">
<style type="text/css" id="syntaxhighlighteranchor"></style>
</head>
<main class="main-container ng-scope" ng-view="">
<div class="main receptacle post-view ng-scope">
<article class="entry ng-scope" ng-controller="EntryCtrl" ui-lightbox="">
<section class="entry-content ng-binding" ng-bind-html="postContentTrustedHtml">
<section class="l-section"><div class="l-section-h i-cf"><h2>Dumpzilla Package Description</h2>
<p style="text-align: justify;">Dumpzilla application is developed in Python 3.x and has as purpose extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers to be analyzed. Due to its Python 3.x developement, might not work properly in old Python versions, mainly with certain characters. Works under Unix and Windows 32/64 bits systems. Works in command line interface, so information dumps could be redirected by pipes with tools such as grep, awk, cut, sed… Dumpzilla allows to visualize following sections, search customization and extract certain content.</p>
<ul>
<li>Cookies + DOM Storage (HTML 5).</li>
<li>User preferences (Domain permissions, Proxy settings…).</li>
<li>Downloads.</li>
<li>Web forms (Searches, emails, comments..).</li>
<li>Historial.</li>
<li>Bookmarks.</li>
<li>Cache HTML5 Visualization / Extraction (Offline cache).</li>
<li>visited sites “thumbnails” Visualization / Extraction .</li>
<li>Addons / Extensions and used paths or urls.</li>
<li>Browser saved passwords.</li>
<li>SSL Certificates added as a exception.</li>
<li>Session data (Webs, reference URLs and text used in forms).</li>
<li>Visualize live user surfing, Url used in each tab / window and use of forms.</li>
</ul>
<p>Dumpzilla will show SHA256 hash of each file to extract the information and finally a summary with totals.<br>
Sections which date filter is not possible: DOM Storage, Permissions / Preferences, Addons, Extensions, Passwords/Exceptions, Thumbnails and Session</p>
<p>Source: http://www.dumpzilla.org/Manual_dumpzilla_en.txt<br>
<a href="http://www.dumpzilla.org/" variation="deepblue" target="blank">Dumpzilla Homepage</a> | <a href="http://git.kali.org/gitweb/?p=packages/dumpzilla.git;a=summary" variation="deepblue" target="blank">Kali Dumpzilla Repo</a></p>
<ul>
<li>Author: Busindre </li>
<li>License: GPLv3</li>
</ul>
<h3>Tools included in the dumpzilla package</h3>
<h5>dumpzilla – Mozilla browser forensic tool</h5>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="c1b3aeaeb581aaa0ada8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# dumpzilla<br>
<br>
Version: 15/03/2013<br>
<br>
Usage: python dumpzilla.py browser_profile_directory [Options]<br>
<br>
Options:<br>
<br>
 --All (Shows everything but the DOM data. Doesn't extract thumbnails or HTML 5 offline)<br>
 --Cookies [-showdom -domain &lt;string&gt; -name &lt;string&gt; -hostcookie &lt;string&gt; -access &lt;date&gt; -create &lt;date&gt; -secure &lt;0/1&gt; -httponly &lt;0/1&gt; -range_last -range_create &lt;start&gt; &lt;end&gt;]<br>
 --Permissions [-host &lt;string&gt;]<br>
 --Downloads [-range &lt;start&gt; &lt;end&gt;]<br>
 --Forms    [-value &lt;string&gt; -range_forms &lt;start&gt; &lt;end&gt;]<br>
 --History [-url &lt;string&gt; -title &lt;string&gt; -date &lt;date&gt; -range_history &lt;start&gt; &lt;end&gt; -frequency]<br>
 --Bookmarks [-range_bookmarks &lt;start&gt; &lt;end&gt;]<br>
 --Cacheoffline [-range_cacheoff &lt;start&gt; &lt;end&gt; -extract &lt;directory&gt;]<br>
 --Thumbnails [-extract_thumb &lt;directory&gt;]<br>
 --Range &lt;start date&gt; &lt;end date&gt;<br>
 --Addons<br>
 --Passwords (Decode only in Unix)<br>
 --Certoverride<br>
 --Session<br>
 --Watch [-text &lt;string&gt;] (Shows in daemon mode the URLs and text form in real time. -text' Option allow filter,  support all grep Wildcards. Exit: Ctrl + C. only Unix).<br>
<br>
Wildcards: '%'  Any string of any length (Including zero length)<br>
           '_'  Single character<br>
       '\'  Escape character<br>
<br>
Date syntax: YYYY-MM-DD HH:MM:SS<br>
<br>
Win profile: 'C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\xxxx.default'<br>
Unix profile: '/home/xx/.mozilla/seamonkey/xxxx.default/'</code>
<h3>dumpzilla Usage Example</h3>
<p>Analyze the Mozilla profile folder <b><i>(‘/root/.mozilla/firefox/k780shir.default/’)</i></b> and dump everything except the DOM data <b><i>(–All)</i></b>:</p>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="6715080813270c060b0e">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# dumpzilla '/root/.mozilla/firefox/k780shir.default/' --All<br>
<br>
====================================================================================================<br>
Cookies              [SHA256 hash: 18d35b51ec9865ea3dd21e9bc69dc3d286d4e20373bbb0b350a0e41c8bf2da42]<br>
====================================================================================================<br>
<br>
<br>
Domain: google.com<br>
Host: .google.com<br>
Name: PREF<br>
Value: ID=ddcc3d04cf65b33f:TM=1400253352:LM=1400253352:S=LrFq_HXVbaconjt0l<br>
Path: /<br>
Expiry: 2016-05-15 11:15:52<br>
Last acess: 2014-05-16 11:15:52<br>
Creation Time: 2014-05-16 11:15:52<br>
Secure: No<br>
HttpOnly: No<br>
<br>
<br>
Domain: kali.org<br>
Host: .kali.org<br>
Name: __utma<br>
Value: 24402336.1888242215.144BAC0N56.1400253356.14322255.1<br>
Path: /<br>
Expiry: 2016-05-15 11:15:55<br>
Last acess: 2014-05-16 11:15:55<br>
Creation Time: 2014-05-16 11:15:55</code>
</div></section><div style="display:none">
<script src="//s11.cnzz.com/z_stat.php?id=1260038378&web_id=1260038378" language="JavaScript"></script>
</div>
</main></body></html>
